Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-53637Mediumsylius/sylius: Sylius: Cart FormComponent allows modification or deletion of an already-completed orderCVE-2026-52778Criticalyeswiki/yeswiki: YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of ServiceCVE-2026-52777Criticalyeswiki/yeswiki: YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserializeCVE-2026-52775Highyeswiki/yeswiki: YesWiki has Authenticated SQL Injection via ReactionManager CVE-2026-52774Mediumyeswiki/yeswiki: YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML AttributesCVE-2026-52773Mediumyeswiki/yeswiki: YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php`CVE-2026-52772Mediumyeswiki/yeswiki: YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html'))CVE-2026-52771Highyeswiki/yeswiki: YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)CVE-2026-52770Highyeswiki/yeswiki: YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filtersCVE-2026-52769Highyeswiki/yeswiki: YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`CVE-2026-52767Highyeswiki/yeswiki: YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`CVE-2026-52766Criticalyeswiki/yeswiki: YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` actionCVE-2026-52763Mediumyeswiki/yeswiki: YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB readCVE-2026-52762Highyeswiki/yeswiki: YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic TemplatesCVE-2026-53769Mediumavo: Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policyCVE-2026-53932Highwnx/laravel-backup-restore: laravel-backup-restore has an OS Command Injection during database restoreCVE-2026-53602Mediumgithub.com/forgekeep/nebula-mesh: nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificateGHSA-382C-VX95-W3P5Medium@jsonbored/gittensory-mcp: Gittensory: Missing contributor-scoped access control on profile endpoint and MCP tool leaks miner financial dataCVE-2026-53760Mediumadmidio/admidio: Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET RequestsCVE-2026-56382Highcraftcms/cms: Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreviewCVE-2026-56394Lowcraftcms/cms: Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file readCVE-2026-53727Highcss_parser: Ruby CSS Parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file`CVE-2026-49485Highca.uhn.hapi.fhir:org.hl7.fhir.dstu2: org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP EndpointCVE-2026-53720Mediumpymonocypher: pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too smallCVE-2026-50553Highgithub.com/enchant97/note-mark/backend: Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo